Policy Packs

guardrails-samples

Ensure that S3 bucket policies do not allow access to all AWS users or non-trusted AWS accounts for enhanced security.

Enforce Trusted Access for Policies on AWS S3 Buckets

main

aws_s3_bucket_policy_trusted_access

Take an action when AWS S3 bucket policy is not trusted based on the&#92;n`AWS &gt; S3 &gt; Bucket &gt; Policy &gt; Trusted Access &gt; *` policies.&#92;n&#92;nThe Trusted Access control evaluates the bucket policy against the list of allowed&#92;nmembers in each of the Trusted Access sub-policies (Trusted Access &gt; Accounts,&#92;nTrusted Access &gt; Services etc.), this control raises an alarm and takes the&#92;ndefined enforcement action.&#92;n&#92;nThe account that owns the bucket will always be trusted, even if its account ID is&#92;nnot included in the Trusted Accounts policy.&#92;n&#92;nIf set to `Enforce: Revoke untrusted access`, access to non-trusted&#92;nmembers will be removed.&#92;n

bucketPolicyTrustedAccess

AWS > S3 > Bucket > Policy > Trusted Access

aws_s3_bucket_policy_trusted_accounts

List of AWS Account IDs that are trusted for cross-account access in the&#92;nAWS S3 bucket policy.&#92;n&#92;nNote that `Trusted Access &gt; Accounts` and `Trusted Access &gt;&#92;nOrganizations` are evaluated independently. To have access, an AWS&#92;nprincipal must be allowed in `Trusted Access &gt; Accounts` AND be a&#92;nmember of an Organization that is allowed in `Trusted Access &gt;&#92;nOrganizations`.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;123456789012&quot;&#92;n```&#92;n**Note**: Setting the policy to an `Empty` array will remove all accounts.&#92;n

bucketPolicyTrustedAccounts

AWS > S3 > Bucket > Policy > Trusted Access > Accounts

aws_s3_bucket_policy_trusted_cloudfront_origin_access_identities

List of [CloudFront Origin Access Identities (OAIs)](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/private-content-restricting-access-to-s3.html) that are trusted for cross-account access in the AWS S3 bucket policy.&#92;n&#92;nThe expected format is an array of `CloudFront OAI ARNs` or `OAI IDs`.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EH1HDMB1FH2TC&quot;&#92;n  - &quot;EH1HDMB1FH2TC&quot;&#92;n```&#92;n**Note**: Setting the policy to an `Empty` array will remove all CloudFront OAIs.&#92;n

bucketPolicyTrustedCloudFrontOriginAccessIdentities

AWS > S3 > Bucket > Policy > Trusted Access > CloudFront Origin Access Identities

aws_s3_bucket_policy_trusted_identity_providers

List of Identity Providers that are trusted for cross-account access in the&#92;nAWS S3 bucket policy.&#92;n&#92;n```&#92;nexample:&#92;n  - www.google.com&#92;n  - www.facebook.com&#92;n```&#92;n**Note**: Setting the policy to an `Empty` array will remove all identity providers.&#92;n

bucketPolicyTrustedIdentityProviders

AWS > S3 > Bucket > Policy > Trusted Access > Identity Providers

aws_s3_bucket_policy_trusted_organization_paths

List of AWS Organization Paths that are trusted for cross-account access in&#92;nthe AWS S3 bucket policy, or &#39;*&#39; to skip the Organization Path Restriction.&#92;n&#92;nNote that `Trusted Access &gt; Accounts` and `Trusted Access &gt;&#92;nOrganization Paths` are evaluated independently. To have access, an AWS&#92;nprincipal must be allowed in `Trusted Access &gt; Accounts` AND be a&#92;nmember of the Organization Path that is allowed in `Trusted Access &gt;&#92;nOrganization Paths`.&#92;n&#92;n**Note**: `Trusted Access &gt; Organization Path Restrictions` are ONLY&#92;napplied to AWS principals. Services and Federated principals do&#92;nNOT contain the `aws:PrincipalOrgPaths` condition key, and thus&#92;ncannot be validated against the Organization Path.&#92;nAlso, please note that this policy will validate organization paths against `ForAnyValue:StringLike` conditional operator for a given bucket policy condition.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;o-333333333/r-wxnb/ou-wxnb-dasdtpaq/ou-*&quot;&#92;n  - &quot;o-444444444/r-wxnb/ou-wxnb-dfadtpaq/*&quot;&#92;n```&#92;n

bucketPolicyTrustedOrganizationPaths

AWS > S3 > Bucket > Policy > Trusted Access > Organization Path Restrictions

aws_s3_bucket_policy_trusted_organizations

List of AWS Organization IDs that are trusted for cross-account access in&#92;nthe AWS S3 bucket policy, or &#39;*&#39; to skip the Organization Restriction.&#92;n&#92;nNote that `Trusted Access &gt; Accounts` and `Trusted Access &gt;&#92;nOrganizations` are evaluated independently. To have access, an AWS&#92;nprincipal must be allowed in `Trusted Access &gt; Accounts` AND be a&#92;nmember of an Organization that is allowed in `Trusted Access &gt;&#92;nOrganizations`.&#92;n&#92;n**Note**: `Trusted Access &gt; Organization Restrictions` are ONLY&#92;napplied to AWS principals. Services and Federated principals do&#92;nNOT contain the `aws:PrincipalOrgId` condition key, and thus&#92;ncannot be validated against the Organization.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;o-333333333&quot;&#92;n  - &quot;o-c3a5y4wd52&quot;&#92;n```&#92;n

bucketPolicyTrustedOrganizations

AWS > S3 > Bucket > Policy > Trusted Access > Organization Restrictions

aws_s3_bucket_policy_trusted_services

List of AWS Services that are trusted for access in the AWS S3 bucket policy.&#92;n&#92;n```&#92;nexample:&#92;n  - sns.amazonaws.com&#92;n  - ec2.amazonaws.com&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all services.&#92;n

bucketPolicyTrustedServices

AWS > S3 > Bucket > Policy > Trusted Access > Services

turbot_policy_setting.aws_s3_bucket_policy_trusted_access

turbot_policy_setting.aws_s3_bucket_policy_trusted_accounts

turbot_policy_setting.aws_s3_bucket_policy_trusted_cloudfront_origin_access_identities

turbot_policy_setting.aws_s3_bucket_policy_trusted_identity_providers

turbot_policy_setting.aws_s3_bucket_policy_trusted_organization_paths

turbot_policy_setting.aws_s3_bucket_policy_trusted_organizations

turbot_policy_setting.aws_s3_bucket_policy_trusted_services

Policy	Setting	Note
AWS > S3 > Bucket > Policy > Trusted Access	Check: Trusted Access
AWS > S3 > Bucket > Policy > Trusted Access > Accounts	- "123456789012" - "123456789013"
AWS > S3 > Bucket > Policy > Trusted Access > CloudFront Origin Access Identities	- "arn:aws:iam::cloudfront:user/CloudFront Origin Access Identity EH1HDMB1FH2TC" - "EH1HDMB1FH2TC"
AWS > S3 > Bucket > Policy > Trusted Access > Identity Providers	- "www.acme.com" - "www.example.com"
AWS > S3 > Bucket > Policy > Trusted Access > Organization Path Restrictions	- "o-c3a5x8sd31/r-wxnb/ou-wxnb-dasdtpaq/ou-" - "o-c3a5x8sd11/r-wxnb/ou-wxnb-dfadtpaq/"
AWS > S3 > Bucket > Policy > Trusted Access > Organization Restrictions	- "o-c3a5x8sd31" - "o-c3a5x8sd11"
AWS > S3 > Bucket > Policy > Trusted Access > Services	- "sns.amazonaws.com" - "ec2.amazonaws.com"

Policy Settings